Pursuant to Articles 13 and 14 of European Regulation 2016/679 ("Regulation") on the protection of individuals with regard to the processing of personal data and on the free movement of such data and in compliance with the Italian legislation in force

Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport ("Company") - as part of the automatic messaging service offered on the smartphone app, on the websites www.milanolinate-airport.com, www.milanomalpensa-airport.com, www.milanairports-shop.com or through Facebook, Apple and WhatsApp platforms (respectively, "ChatBot Service" and "Platforms") - processes users' personal data.

Processing of personal data means any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as collection, registration, organization, structuring, storage, processing, selection, blocking, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of provision, comparison or interconnection, restriction, erasure or destruction.

The Company will therefore proceed with the relative processing for the purposes listed below by hand and/or with the support of computer or data transmission systems.

1. Types of data processed and source of data.

The Company will process personal data provided by users through their use of the Chatbot Service on www.milanolinate.airport.com, www.milanomalpensa-airport.com, www.milanairports-shop.com/en or the Platforms, when the customer uses the Chatbot Service on the Platforms ("Personal Data"), including: the first and last name with which users are registered on the referring Platform, the content of conversations (including, name, surname, e-mail used during the purchase, date and time of the purchased flight, language used, the rating given to the quality of the Chatbot Service, etc.)
The Company does not require the user to transmit information that can be traced back to particular categories of data, such as data relating to their health status, sexual orientation, political opinions, etc. However, it is possible that the user may provide particular categories of data freely and unconditionally and for purposes in line with the user's expectations.

2. Purpose and legal basis for processing data

Personal Data is collected and processed by the Company to provide information about airport operations.
Personal Data is processed on the basis of the legitimate interest of the Company identified in the adequate and timely management of users' requests.
Particular data which may be communicated by users will be processed by the Company under the legal basis referred to in Article 9, letter e) of the Regulation, i.e. as personal data made manifestly made public by the data subject.
After this period, your personal data will be made permanently anonymous to allow the company to perform statistical analysis of your use of the ChatBot Service.

3. Disclosure and dissemination of personal data for the pursuit of the purpose of processing

The data may be disclosed to third parties when the disclosure is required by law, including the scope of prevention/repression of any illegal activity. The data may be communicated exclusively for the pursuit of the purposes set out in paragraph 1 of this privacy policy to employees/collaborators/consultants of the Company, as well as to third party companies which collaborate with the Company for the pursuit of the same purposes. In particular, for the provision of the ChatBot Service, the Company has appointed Airport AI as external data processor.
The updated list of external processors is available at the Company's registered office.
The data will not be disclosed, specifically personal data will not be disclosed to the public or, in any case, to an indeterminate number of parties.

4. Transfer of personal data to countries outside the European Union.

The data collected and processed shall not be transferred to companies or other entities outside the EU territory.

5. Data retention period

With reference to Common Data to be processed, they will be stored in compliance with the principle of proportionality and until the purposes of the processing have been achieved, in any case, for a period not exceeding 1 month from their collection. In addition, after the period specified in paragraph 5 below, SEA may anonymize personal data in order to conduct statistical analysis on the use of the ChatBot Service.

6. Data controller

The identification details of the data controller company are as follows:
Società per azioni Esercizi Aeroportuali S.E.A., with registered office in Segrate (Milan) - 20054 - at Milan-Linate Airport.

7. Data Protection Officer (DPO)

It is possible to contact the Data Protection Officer, also for the exercise of the rights of data subjects pursuant to articles 15-22 of the Regulation, by sending an email to: privacy@seamilano.eu.

8. Rights of the data subjects

In relation to the processing of data, the data subject is entitled to exercise the rights set out in Articles 15 to 22 of European Regulation 2016/679, reproduced in reduced form in Annex A to this privacy policy.
Exercising of such rights is not subject to any formal restriction and is free of charge.

Attachment A
European regulation on the protection of personal data
Articles 15 to 22

Pursuant to Articles 15 to 22 of European Regulation 2016/679, the data subject has the right to obtain from the data controller the rectification, integration or erasure (so-called right to be forgotten) of his/her personal data; the right to obtain the limitation of the processing and the right to data portability, the right to object to the processing of personal data, including profiling and, finally, the right to lodge a complaint with the Guarantor Authority.